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Dated; 13 May 2015 


This Policy supersedes NSA/CSS Policy 1-30 dated 10 May 2013. 

OPI: The Office of Information Security Policy, DJ2, 969-2882 (secure) or (443) 654-4596 
(public). 

POLICY 

1. Public release in an official capacity: 

a. NSA/CSS makes certain accurate and timely information available to the public 
to promote accountability for and understanding of its activities. The public release of 
official NSA/CSS information shall be limited only as necessary to safeguard information 
requiring protection in the interest of national security or other legitimate Government 
interest (Reference a) . All current NSA/CSS affiliates shall submit for prepublication 
review all official NSA/CSS information intended for public release in their official 
capacity. The prepublication review process includes both a classification review and a 
review that determines whether the infoimation intended for public release: is consistent 
with established NSA/CSS, DoD, and Intelligence Community policies and programs; is 
consistent with information security standards established by the Associate Director for 
Policy and Records (ADPR); and conforms to NSA/CSS corporate messaging standards 
as determined by the Associate Director for Strategic Communications. 

b. Official NSA/CSS information prepared as part of official duties and approved 
for public release will be used in accordance with DoD Directive (DoDD) 5500.07, 
“Standards of Conduct” (Reference bi . and DoD 5500.7-R, “Joint Ethics Regulation 
(JER)” (Reference ci . which preclude such use for monetary or nonmonetary personal 
gain. 

2. Public release in a private capacity; NSA/CSS affiliates acting in a private capacity, 
and not in connection with their official duties, may prepare information for public release 
without management approval or policy review provided that the affiliate: 

a. Violates no laws or regulations; 

b. Maintains ethical standards and compliance with References b and c: 

c. Uses only information that is UNCLASSIFIED and approved for public 

release; 

d. Uses no information in which NSA/CSS may have intellectual property rights 
and must file a new patent application with the U.S. Patent and Trademark Office thereon 
or lose the right to do so (i.e., the information, if publicly released, does not establish a 
date by which NSA/CSS must file a new patent application (e.g., 1 year after public 
release)); and 
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e. Uses a disclaimer on any material in which an NSA/CSS affiliation is cited, 
stating that the views and opinions expressed are those of the affiliate and do not reflect 
those of NSA/CSS. 

3. Information available from both classified and open sources: 

a. Official NSA/CSS infoimation appearing in the public domain shall not be 
automatically considered UNCLASSIFIED or approved for public release. 

b. Where information intended for public release is available to the NSA/CSS 
affiliate from classified sources and also independently from open sources, the affiliate 
may be permitted to release the information if the affiliate can cite an adequate open 
source publication where the specific infonnation is available - only if release of the 
information by the affiliate at the time of review will not cause additional damage to 
national security through confirmation of previous unauthorized releases. The 
Prepublication Review Authority shall exercise discretion in making such determinations 
on a case-by-case basis and may consider the following as factors in the decision: 

1) The sensitivity of the information from classified sources; 

2) The number and cun-ency of the previous releases; 

3) The level of detail previously exposed; 

4) The source of the previous releases (whether authoritative and 
acknowledged or an anonymous leak); 

5) The submitter’s aecess to elassified sources; and 

6) The authority and credibility afforded by the affiliate’s NSA/CSS 
experience. 

4. Official NSA/CSS organizational logos: A loso may be created in accordance with 
NSA/CSS Policy 10-7, “NSA/CSS Multimedia Information” (Reference d) . Once Multimedia 
Solutions (DN2) creates a proof of the logo, it must be reviewed and approved for public release 
in an official capacity as set forth in this policy. Once approved for public release, a logo may be 
used for official NSA/CSS operational, promotional, or morale-building purposes. 

PROCEDURES 

5. For public release in official capacity: 

a. Information intended for public release in an NSA/CSS affiliate’s official 
capacity (including, but not limited to, books, articles, videos, speeches, conference 
briefings, Internet postings, biographies, book reviews, cooperative education (co-op) 
reports, press releases, research papers, and organizational logos) is subject to 
prepublication review. 
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b. Before publicly disclosing his or her NSA/CSS affiliation, a current affiliate 
preparing material for public release in an official capacity shall seek operations security 
(OPSEC) guidance from his or her Staff Security Officer (SSO) and solicit a name check 
from Chief, Cover, Control, and Special Access Programs (S024) in accordance with 
NSA/CSS Policy 1-18, “NSA/CSS Cover Program” (Reference e) . 

c. Whenever practicable, to preclude the inadvertent spillage of classified 
information onto unclassified systems, NSA/CSS affiliates acting in an official capacity 
shall use a TOP SECRET classified information system (e.g., NSANet, JWICS) to draft 
the full material intended for public release. Notes, outlines, or other partial information 
may not be substituted for the full material intended for public release in order to avoid 
the possibility of classification due to compilation. 

d. Current NSA/CSS affiliates acting in an official capacity shall first submit, for 
management review and approval, all official NSA/CSS information intended for public 
release. 


e. Upon receipt of management approval for public release (which may be in the 
form of a digitally signed email), a current NSA/CSS affiliate acting in an official 
capacity submits the following to a local Classification Advisory Officer (CAP) for an 
initial classification determination: the full material intended for public release, 
management approval, and written consent from NSA/CSS affiliates identified in the 
information to have any NSA/CSS affiliation publicly revealed. A complete list of CAOs 
can be found on NSANet (“ go cap” ). 

f. Upon determining the information to be UNCLASSIFIED, the CAO sends a 
digitally signed email to the affiliate containing that determination. 

g. Following procedures established by the Prcpublication Review Authority, 
either the affiliate or the local CAO then forwards the full and final material intended for 
public release (with all classification markings and/or handling instructions removed), 
management approval, classification determination, written consent from affiliates 
identified in the information to have any NSA/CSS affiliation publicly revealed (if 
applicable), technical review (if applicable), and contracting officer approval (if 
applicable) to the appropriate NSA/CSS Prepublication Review Authority for the final 
prepublication review determination. 

h. The appropriate Prepublication Review Authority shall: 

1) As necessary, coordinate with other information owners should the 
material contain information not under his or her purview; 

2) Refer the information for review to organizations external to NSA/CSS, 
if required; 

3) Coordinate, as appropriate, a review with the Associate Directorate for 
Strategic Communications (DN) to determine that information intended for public 
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release in an affiliate’s official capacity conforms to NSA/CSS corporate 
messaging standards; 

4) When necessary, request a technical review by a subject matter expert 
to determine that the information intended for public release is accurate; 

5) When necessary, request a review by the NSA/CSS Office of the 
General Counsel (OGC) to determine that the information intended for public 
release contains no information in which NSA/CSS may have intellectual 
property rights and may file a patent application thereon; and 

6) If the current NSA/CSS affiliate acting in an official capacity is a 
Senior Leader , coordinate with the Office of Information Security Policy (DJ2) to 
obtain prepublication approval from the Defense Office of Prepublication and 
Security Review (DOPSR). 

i. The appropriate Prepublication Review Authority will issue, as practicable, a 
final determination to the affiliate within 25 business days of receipt of all required 
information and supporting documentation. 

6. For public release in a private capacity: 

a. Resumes, associated cover letters, work-related biographies (bios), and 
cuniculum vitae (CVs) intended for any public use: Current and former NSA/CSS 
affiliates shall submit resumes, associated cover letters, work-related bios, and CVs 
intended for public release to the Office of Information Security Policy (DJ2) for review 
according to procedures published on the Office of hiformation Security Policy (DJ2) 
Web site and on nsa.gov to determine whether they contain NSA/CSS vrotected 
information . 


1) Before publicly disclosing his or her NSA/CSS affiliation in such a 
document, a current affiliate shall seek OPSEC guidance from an SSO and solicit 
a name check from Chief, S024. 

2) Whenever practicable and with supeiwisoiy approval, to preclude the 
inadvertent spillage of classified infoimation onto unclassified systems, current 
NSA/CSS affiliates acting in a private capacity may use a TOP SECRET 
classified information system (e.g., NSANet, JWICS) to draft the full version of 
such documents intended for public release. Notes, outlines, or other partial 
information may not be substituted for the full material intended for public release 
in order to avoid the possibility of classification due to compilation. 

3) A current affiliate shall have such documents first reviewed by an 
organizational CAO before submitting it to DJ2. 

4) FoiTner affiliates shall submit such documents per instructions in 
paragraph 6.b.4 . 
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5) Resumes are not subject to management approval or poliey review. 

b. Other than resumes: Current and former NSA/CSS affiliates may prepare 
material for public release that meets all of the requirements stated in paragraph 2 . This 
includes, but is not limited to, books, articles, videos, speeches, conference briefings, 
Internet postings, book reviews, co-op reports, press releases, research papers, and 
organizational logos. However, prepublication review is required where compliance with 
the requirements of paragraph 2 is in doubt (i.e., where the material contains official 
NSA/CSS infoiTnation that may or may not be UNCLASSIFIED and approved for public 
release). Before publicly disclosing an NSA/CSS affiliation, a current affiliate shall seek 
OPSEC guidance from an SSO and solicit a name check from Chief, S024. 

1) Whenever practicable and with supervisory approval, to preclude the 
inadvertent spillage of classified information onto unclassified systems, current 
NSA/CSS affiliates acting in a private capacity may use a TOP SECRET 
classified information system (e.g., NSANet, JWICS) to draft die full material 
intended for public release. Notes, outlines, or other partial information may not 
be substituted for the full material intended for public release in order to avoid the 
possibility of classification due to compilation. 

2) A current affiliate with access to a TOP SECRET classified network 
(e.g., NSANet, JWICS) shall request review by his or her organization’s CAO of 
the full material intended for public release. After review, the organization’s 
CAO will send the full and final material and the initial determination to the 
appropriate Prepublication Review Authority for a second review. 

3) Current affiliates without access to a TOP SECRET classified network 
(e.g., NSANet, JWICS) may submit the full and final material intended for public 
release via another classified system (e.g., SIPRNet) to the appropriate 
Prepublication Review Authority according to established procedures. 

4) Former affiliates without aecess to a TOP SECRET classified network 
(e.g., NSANet, JWICS) shall submit the full and final material intended for public 
release in hardcopy to: 

NSA/CSS 

ATTN: DJ2, Prepublication Review 

9800 Savage Road 

Suite 6248 

Fort George G. Meade, MD 20755-6248 

5) The appropriate Prepublication Review Authority shall create an 
official record of the documents reviewed and the determinations made. 
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6) As necessary, the appropriate Prepublieation Review Authority shall 

coordinate with other information owners when the material contains information 

under their purview. 

7) The appropriate Prepublication Review Authority shall, as practicable, 

issue the detemiination to the affiliate within 25 business days of receipt. 

7. Appeal of a prepublication review determination: 

a. A prepublication review deteimination may be appealed in writing to the 
ADPR within 20 business days of receipt of the determination. At the ADPR’s 
discretion, an additional 30 business days may be allowed to file a written appeal, 
provided that the affiliate files a written notice of intent to appeal within 20 business days 
of receipt of the initial determination and presents justification to support an extension. 
The affiliate making the appeal shall speeifically identify the disputed portions of the 
initial deteimination and the reasons for appeal - and shall include any supporting 
information that the ADPR should consider. 

b. In support of the ADPR, the Offiee of Information Seeurity Policy (DJ2) will, 
if necessary, schedule meetings with the NSA OGC and/or the information owners to 
review the disputed infoimation and, within 30 business days of receipt of the appeal, 
advise the affiliate making the appeal of the ADPR’s final determination and, to the 
extent consistent with national security, the reasons for any ADPR deteimination adverse 
to the affiliate’s interests. 

c. Tlie final determination by the ADPR may not be further appealed. 

RESPONSIBILITIES 

8. A eurrent NSA/CSS affiliate acting in an official capacity shall: 

a. Before disclosing his or her NSA/CSS affiliation, solicit a name cheek from 
Chief, S024 in aeeordance with Reference e: 

b. Seek OPSEC guidance from an SSO regarding the possible eonsequences of 
diselosing his or her NSA/CSS affiliation; 

c. Submit for prepublication review all materials intended for public release 
according to the procedures specified in paragraph 5; 

d. As applicable, obtain written consent from each affiliate identified in the 
information to have his or her NSA/CSS affiliation publicly revealed; and 

e. In accordance with established procedures, submit to the appropriate 
Prepublication Review Authority his or her requests for prepublication review along with 
all required infoimation identified in paragraph 5.g. . 
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9. Current NS A/CSS affiliates acting in a private capacity shall: 

a. Before disclosing their NSA/CSS affiliation, solicit name checks from Chief 
S024 in accordance with Reference c : 

b. Seek OPSEC guidance from an SSO regarding the possible consequences of 
disclosing their NSA/CSS affiliation; 

10. Current and former NSA/CSS affiliates acting in a private capacity shall: 

a. Submit for prepublication review all materials intended for public release 
according to the procedures specified in paragraph 6 : 

b. Notify NSA/CSS of any request to comment on any unofficial NSA/CSS- 
related information (e.g., to review a book by a non-Govemment author prior to 
publication, to review an article). Tlie NSA/CSS affiliate shall regard his/her comments 
as a proposed unofficial publication subject to review, as provided by this policy. If the 
appropriate Prepublication Review Authority determines that all or part of the text being 
commented on must be reviewed in order to evaluate the comments, the affiliate shall 
obtain permission from the author before submitting relevant parts of any unpublished 
text to NSA/CSS for review; and 

c. As applicable, obtain written consent from each affiliate identified in the 
information to have his or her NSA/CSS affiliation publicly revealed. 

11. Classification Advisory Officers (CAOs) shall: 

a. Conduct an initial classification review of information submitted by an affiliate 
in their supported organizations, in accordance with current NSA/CSS classification and 
declassification guidance; 

b. Provide the affiliate with a digitally signed email message or, if email is not 
practicable, an appropriately classified letter containing the classification determination; 
and 


c. hi accordance with established procedures and on behalf of the affiliate, submit 
a request for prepublication review to the appropriate Prepublication Review Authority 
(see paragraph S.g.l . 

12. Prepublication Review Authorities shall: 

a. Assist the CAO, when necessary, in resolving classification disputes; 

b. Coordinate reviews, as appropriate, with DN for conformance to messaging 
standards; 
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c. If the cunent NSA/CSS affiliate acting in an official capacity is a Senior 
Leader, coordinate with the Office of Information Security Policy (DJ2) to obtain 
prepublication approval fi’om the DOPSR; 

d. Coordinate prepublication reviews with any other NSA/CSS offices as required 
by, and specified in, this policy; 

e. Coordinate prepublication reviews with external information owners (e.g., U.S. 
Government, foreign government), as appropriate; 

f Conduct, as practicable, final prepublication reviews of all infonnation 
intended for public release within 25 business days of receipt; 

g. Notify the affiliate in writing of the determination; and 

h. Maintain all required electronic and hardcopy official records related to 
prepublication review deteiminations in accordance with this policy and NSA/CSS Policy 
1-6, “Records Management Program” (Reference f) : 

13. The Office of Information Security Policy (DJ2) shall perform all of the functions of 
a Prepublication Review Authority (see paragraph 12) and shall; 

a. Serve as the sole approval authority for the public release of personal resumes; 

b. Coordinate with the DOPSR to obtain public release approval when the cuiTent 
NSA/CSS affiliate acting in an official capacity is a Senior Leader; 

c. Review and approve or disapprove management directives and any other 
procedures developed to implement this policy;' 

d. Maintain accountability and a database for all required electronic and hardcopy 
official records related to prepublication review deteiminations in accordance with 
Reference f; and 

e. Administi atively assist the ADPR in the processing of prepublication review 
appeals. 

14. The Infoimation Assurance Director and Research Director, in addition to the 
responsibilities in paragraph 15. shall; 

a. Issue management directives to implement this policy that have been approved 
by the Office of Information Security Policy (DJ2); 

b. Provide a monthly accounting of prepublication review cases to the Office of 
Information Security Policy (DJ2); and 
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c. Grant the Office of Information Security Policy (DJ2) access to any databases 
used for the electronic storage and tracking of prepublication review cases. 

15. The Directors, Associate Directors, NSA/CSS Chief of Staff, and Extended 
Enterprise Commanders/Chiefs shall; 

a. Develop a process, consistent with the provisions in this policy, for ensuring 
the proper prepublication review of official NSA/CSS information intended for public 
release; 


b. Ensure that personnel under their supervision are made aware of the 
requirements of this policy; and 

c. Ensure that subordinates’ requests for management review and approval of 
official NSA/CSS infoimation intended for public release pursuant to paragraph 5.b are 
completed in a timely manner. 

16. The Associate Directorate for Security and Counterintelligence (Q) shall: 

a. Ensure that, during initial indoctrination, all affiliates arc informed of their 
lifelong responsibility to safeguard NSA/CSS protected information and of the 
procedures for prcpublication review; 

b. Ensure that all affiliates are reminded of their lifetime prepublication review 
responsibilities prior to signing their security debriefing forms at the end of their 
affiliation with the Agency; and 

c. Via SSOs, provide OPSEC guidance to cunent affiliates regarding the possible 
consequences of publicly disclosing their NSA/CSS affiliation when preparing official 
NSA/CSS information for public release in either an official or private capacity. 

17. The Office of General Counsel (OGC) shall; 

a. Provide legal advice to a Prepublication Review Authority when material 
intended for public release contains any information in which NSA/CSS may have 
intellectual property rights and may file a patent application thereon; 

b. Ensure, in coordination with the Directorate of Acquisition (BA), that contracts 
contain necessary provisions to require compliance with the provisions of this policy by 
contractors and their employees; and 

c. Provide legal advice and guidance to the Office of Information Security Policy 
(DJ2) and the ADPR during the appeal process, as necessary and as required. 

18. The Directorate of Acquisition (BA) shall ensure, in coordination with the OGC, that 
contracts contain necessary provisions to require compliance with the provisions of this policy 
by contractors and their employees. 
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19. The Associate Directorate for Sfrategic Communications (DN) shall, as appropriate, 
perform a review on all information intended for public release in an official capacity within 10 
business days of receipt to ensure that information intended for public release conforms to 
current NSA/CSS messaging standards as determined by the Associate Director for Strategic 
Communications. 

20. The Chief, Cover, Control, and Special Access Programs (S024) shall conduct name 
checks as requested by current affiliates preparing official NSA/CSS information for public 
release in either an official or private capacity in accordance with Reference e. 

REFERENCES 


21. References 

a. DoDD 5230.09 “Clearance of DoD Information for Public Release,” dated 
22 August 2008. 

b. DoDD 5500.07. “Standards of Conduct,” dated 29 November 2007. 

c. DoD 5500.7-R. “Joint Ethics Regulation (JER),” dated 1 August 1993. 

d. NSA/CSS Policy 10-7. “NSA/CSS Multimedia Information,” dated 
12 August 2009 and revised 1 May 2013. 

e. NSA/CSS Policy 1-18. “NSA/CSS Cover Program,” dated 6 March 2014. 

f NSA/CSS Policy 1-6. “Records Management Program,” dated 
19 November 2014. 

g. Executive Order 13526. “Classified National Security Information,” dated 
29 December 2009. 

h. Public Law No. 86-36 (codified as amended in 50 U.S.C. § 3605), “National 
Security Agency Act of 1959.” 

i. 5 U.S.C S 552. “Freedom of Information Act.” 

DEFINITIONS 

22. Affiliate - A person employed by, detailed to, or assigned to NSA/CSS, including a 
member of the U.S. Armed Forces; an expert or consultant to NSA; an industrial or commercial 
contractor, licensee, certificate holder, or grantee of NSA, including all subcontractors; a 
personal services contractor; or any other category of person who acts for or on behalf of 
NSA/CSS as deteimined by the Director, NSA/Chief, CSS. (Source: Corporate Glossaiw) 

23. Classification Advisory Officer (CAP) - An individual trained and certified by the 
Office of Information Security Policy (DJ2) to properly apply classification rules and guidance 
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and who assists other employees in the proper marking and protection of classified and protected 
information. 

24. Logo - An unclassified graphical representation of an NSA/CSS-rclatcd special 
office, mission, program, or project. 

25. Name Check - A review of past assignments, including assignments to other agencies 
and participation in educational programs, to determine the classification of an individual’s name 
in association with NSA/CSS (Reference e) . 

26. Nondisclosure Agreement (NdAl - A lifetime obligation to safeguard all protected 
information, to submit all information intended for publication and/or public release for 
prepublication review, and to report any imaiithorized disclosure of protected information. 
NSA/CSS affiliates are legally bound and obligated by any NdAs they sign for access to 
NSA/CSS infoimation. They shall not confirm or deny infoimation about NSA/CSS that appears 
in the public domain without prior approval through the classification or prepublication process. 

27. NSA/CSS Protected Infonnation - Information obtained as a result of a relationship 
with NSA/CSS, that is: 

a. Classified or in the process of a classification deteimination pursuant to the 
standards of Executive Order 13526 (Reference g) . or any successor order, and 
implementing regulations. It includes, but is not limited to, intelligence infoimation, 
sensitive compartmented infoimation (intelligence sources and methods), and ciyptologic 
information (information concerning information systems security and signals 
intelligence); or 

b. Unclassified, appearing in any form or compilation, which NSA/CSS may 
withhold from public disclosure under authority of tlie National Security Agency Act of 
1959 (Reference h) or by reason of being either excluded or exempted from the 
mandatory disclosure requirements of the Freedom of Information Act (Reference i) . 
(Source: Corporate Glossary) 

28. Official Capacity - Acting on behalf of NSA/CSS. 

29. Official NSA/CSS Information - Any NSA/CSS, DoD, or IC information that is in 
the custody and control of NSA/CSS and was obtained for or generated on NSA/CSS’ behalf 
during the course of employment or other service, whether contractual or not, with NSA/CSS. 

30. Prepublication Review - The overall process to determine that information proposed 
for public release contains no protected infoimation and, where applicable, is consistent with 
established NSA/CSS, DoD, and IC policies and programs; conforms to NSA/CSS messaging 
standards as determined by the Associate Director for Strategic Communications; and, in 
consultation with the NSA OGC, Acquisition, Research, and Technology Law, as appropriate, 
contains no information in which NSA/CSS may have intellectual property rights and may file a 
patent application thereon. 
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31. Prepublication Review Audioritv - Officials in organizations who are delegated the 
authority to make deteiminations on prepublication reviews. The Office of Information Security 
Policy (DJ2) serves as the coiporate-level Prepublication Review Authority and as such has the 
authority to make a detennination on any prepublication review and has sole authority for the 
prepublication review of personal resumes, associated cover letters, bios, and CVs. The ADPR 
has officially delegated Prepublication Review Authority to the Research Directorate and to the 
Infonnation Assurance Directorate (for anything other than personal resumes). 

32. Private Capacity - Acting on behalf of oneself and not in association with NSA/CSS. 

33. Public Release - The decision to give permission to retain, or to show or reveal 
official NSA/CSS information whether orally, in writing, or through any other medium, to one or 
more persons who otherwise do not have the appropriate access authorization, security clearance, 
and/or need to know to receive such information upon determination that the release will not 
harm the national security or another legitimate Government interest. 

34. Senior Leader - A Defense Intelligence Senior Executive Service (DISES) employee, 
a Defense Intelligence Senior Level (DISL) employee, or the military equivalent of a DISES or 
DISL employee. 

35. Unauthorized Disclosure - Absent a public release, the communication or physical 
transfer of protected information to one or more unauthorized recipients who do not have 
appropriate access authorization, security clearance, and/or need to know to. receive such 
infonnation. 
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